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Abstract 


The fc’th frequency moment of a sequence of integers is defined as F\ ng where rij 

is the number of times that j occurs in the sequence. Here we study the quantum complexity 
of approximately computing the frequency moments in two settings. In the query complexity 
setting, we wish to minimise the number of queries to the input used to approximate F k up 
to relative error e. We give quantum algorithms which outperform the best possible classical 
algorithms up to quadratically. In the multiple-pass streaming setting, we see the elements 
of the input one at a time, and seek to minimise the amount of storage space, or passes over 
the data, used to approximate F k . We describe quantum algorithms for To, F 2 and TP in this 
model which substantially outperform the best possible classical algorithms in certain parameter 
regimes. 

1 Introduction 

Given a sequence of integers a ±,..., a n , where cij G [m] := {1,..., m} for each i, let rij denote the 
number of elements in the sequence which are equal to the integer j. Then the Afth frequency 
moment is defined as 



Thus, for example, To is the number of distinct elements in the sequence, and T\ = n. We also 
define TP, := maxj rij. Here we consider only integer k , and look to approximate F k up to relative 
error e with bounded failure probability, or in other words to output F k such that 


Pr[|T\. - Tfc| > eF k ] < 1/3. 


As well as the intrinsic mathematical interest of this fundamental problem, it also has many practical 


uses, with To and T 2 in particular occuring in database applications (see e.g. [2, 20]). It is therefore 
unsurprising that a vast amount of work, in a variety of different contexts, has been done to 
characterise the complexity of approximating the frequency moments; we summarise some of this 
below. In this work we address the complexity of approximating the frequency moments using a 
quantum computer. 

We consider two different models where one could hope to achieve quantum speedups, both of 
which correspond to well-studied versions of the problem classically: 
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• The streaming model. In this model, we receive each item a* one at a time, in sequence. In 
the single-pass streaming model, we are asked to output an estimate for F\ at the end of the 
sequence. In the multiple-pass streaming model, the stream repeats a number of times and 
we are asked to output an estimate after some number of repetitions. The challenge is that 
we assume that we only have access to limited storage space, and in particular not enough to 
store the whole stream. 

• The query complexity model. Here we can query arbitrary elements a*, and seek to approxi¬ 
mate Tfc using the minimal number of queries. 

We assume in both cases that we know the total number of elements n in advance. This seems to 
be essential in the query complexity model in order to enable queries to arbitrary elements of the 
input. In the streaming model, our algorithms will actually only need an upper bound on n. We 
allow probability of failure 1/3, which can be improved to 5 , for arbitrary fixed 6 > 0, by repetition 
and taking the median. 

In each of the above models, which we define somewhat more formally below, we obtain quantum 
improvements over the best possible classical complexities. Our main results can be summarised 
as follows: 

• In the query complexity model, To can be approximated with 0(y/n/e) quantum queries, as 
compared with the classical lower bound of II(n) for e = 0(1) [20], and this bound is tight. 

• In the query complexity model, T/ can be approximated with O(n( 1_1// 0( 1 - 2fc “/( 2 fc —i)) 
quantum queries 1 for k > 2, as compared with the classical lower bound of II(n 1 ^ 1//fc /e 2 ) [1]. 
Observe that (1 — 2 k ~ 2 /(2 k — 1)) < 3/4 for all k > 2, so this gives an asymptotic separation 
for all such k. In the important special case of T 2 , the quantum upper bound is 0(n 1//3 / e 2 ), as 
compared with the classical lower bound H(n 1 / 2 /e 2 ), and the dependence on n of this bound 
is tight up to logarithmic factors. 

• In the streaming model, Fq can be approximated by a bounded-error quantum algorithm 
which stores 0((logn) log 1/e) qubits and makes 0(l/e) passes over the input. Any classical 
algorithm that makes T passes over the input must store fl(l/(e 2 T)) bits [19], assuming that 
e = n(l/- v /m). 

• In the streaming model, F 2 can be approximated by a bounded-error quantum algorithm 
which stores 0(logn + log(l/e)) qubits and makes 0(l/e) passes over the input. The classical 
lower bound is the same as for To [19]. 

• In the streaming model, TZo can be computed exactly by a bounded-error quantum algorithm 
which stores 0(log 2 n) qubits and makes 0(y/n) passes over the input. For sufficiently large 
m, any classical algorithm that makes T passes must store fl(n/T) bits [3]. 

• The above quantum upper bounds in the multiple-pass streaming model are all optimal, up 
to logarithmic factors. 

For simplicity, we assume in these bounds that m is quite large, m > 2 n; more detailed complexities 
are given in the statements of the individual bounds below. We can also always assume that 
m = 0(n 2 ) because we can hash all the input elements to a set of size 0(n 2 ) without affecting the 

lr The O notation hides polylogarithmic factors. 


2 



frequency moments, with 99% probability; thus logm = 0(logn). Finding efficient algorithms in 
terms of m for smaller universe sizes m has also been an important theme classically. However, the 
separations we obtain are generally maximised for large m. 

Depending on n and e, the quantum streaming complexities for Fq and Fi may not be substan¬ 
tially better, or could even be worse, than their corresponding classical lower bounds [19]. Further, 
the classical bounds are almost tight, as there exist single-pass streaming algorithms for these fre¬ 
quency moments which use 0(l/e 2 + logm) [31] and 0((logm)/e 2 ) [3] bits of storage, respectively. 
The quantum algorithms outperform the classical lower bounds in the regime 1 /\fm <C e <C 1/logn. 

If we consider streaming algorithms which are restricted to making 0(l/e) passes, classical 
algorithms for To and F^ must store H(l/e) bits [19], whereas the quantum algorithms store 
0((logn) log 1/e) or 0(logn + log 1/e) qubits, respectively. For large m and small e (say m = 0(n), 
e = 0(1 /n s ) for some 5 > 1/2), this is exponentially smaller than the best possible classical com¬ 
plexity. However, if we consider the product of the space usage S and the number of passes T 
(a standard measure used in time-space tradeoffs), the classical lower bound is TS = H(l/e 2 ), 
while the quantum upper bounds satisfy TS = 0((logn)/e). These could therefore be seen as 
near-quadratic separations. 

The separations we obtain in the multiple-pass streaming model are, arguably, the first demon¬ 
stration of a quantum advantage over classical computation for computing functions of practical 
interest in this model. Exponential separations have been shown in the one-pass streaming model 
by Gavinsky et al. [25] for a partial function, and by Le Gall [36] for a total function. Unfor¬ 
tunately, these functions seem somewhat contrived. (However, it is possible to reinterpret the 
result of Le Gall as applying to computing the Disjointness function in the multiple-pass streaming 
model. In this setting the problem becomes more natural but the complexity reduction becomes 
only quadratic.) 

1.1 Related work 

There has been a huge amount of work characterising the classical complexity of approximating 
the frequency moments in various settings, only a fraction of which we mention here. See, for 
example, [15, 31] for further references. 

In the streaming model: 

• (To) Flajolet and Martin gave a single-pass streaming algorithm which uses O(logm) bits of 
space and computes To up to a constant factor [24]. Alon, Matias and Szegedy improved this 
by replacing the randomness used in the Flajolet-Martin algorithm with a family of simple 
hash functions [3]. Bar-Yossef et al. gave several different algorithms for approximating Fq 
up to a (1 + e) factor, using as little as O (1/e 2 + logm) space [8]. Kane, Nelson and Woodruff 
have now completed this line of research by giving a single-pass streaming algorithm which 
approximates Fq using 0(l/e 2 + logm) space [31]. This is optimal for single-pass streaming 
algorithms; a space lower bound of D(log?n) was shown by Alon, Matias and Szegedy [3], and 
a lower bound of H(l/e 2 ) was shown by Woodruff [42]. This was generalised to an H(l/(e 2 T)) 
lower bound for T-pass streaming algorithms by Chakrabarti and Regev [19]. 

• {F-i) Alon, Matias and Szegedy gave an 0((logm)/e 2 ) single-pass streaming algorithm [3], 
and also showed an H(logm) lower bound. An H(l/e 2 ) lower bound for single-pass streaming 
algorithms was proven by Woodruff [42], which was similarly extended to an D(l/(e 2 T)) lower 
bound for T-pass streaming algorithms by Chakrabarti and Regev [19]. 
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• (Fk, k > 2) Alon, Matias and Szegedy gave single-pass streaming algorithms using space 
0(m 1-1//fc ) [3]. An almost-optimal O(m 1 ^ 2 / fc /e 10+4,/fc ) algorithm was later given by Indyk and 
Woodruff for any k > 2 [30]. This was simplified by Bhuvanagiri et ah, who also improved the 
dependence on e [13]. Very recently, Braverman et al. gave an 0(m 1_2 / fc ) algorithm for k > 3 
and e = 12(1) [15]. This effectively matches the tightest known general space lower bound on 
T-pass streaming algorithms, 12(m 1 ^ 2 / fc /(e 4 / fc T)) shown by Woodruff and Zhang [43]. 

• (Too) Alon, Matias and Szegedy showed an 12(m) space lower bound [3], even for multiple-pass 
streaming algorithms with constant e, by a reduction from the communication complexity of 
Disjointness. 

Near-optimal time-space tradeoffs for the related problem of exactly computing frequency moments 
over sliding windows were proven by Beame, Clifford and Machmouchi [10]. 

The classical query complexity of approximating the frequency moments has also been studied, 
under the name of sample complexity. Charikar et ah [20] gave a lower bound of D(n(l — e) 2 ) queries 
for approximating Fq. For any k > 2, Bar-Yossef [7] showed a lower bound of n(n 1_1//fe /e 1//fc ), and 
a nearly matching upper bound (for e = 12(1), k = 0(1)) of 0(n 1_1 / fc /e 2 ). Very recently, the lower 
bound has been improved to a tight I2(n 1_1 / fc /e 2 ) by Acharya et ah [1], 

In the quantum setting, remarkably little seems to be known about the complexity of approx¬ 
imately computing frequency moments. Coffey and Prezkuta [21] propose a quantum algorithm 
based on quantum counting which computes T^ exactly for a sequence of n elements, each picked 
from a set of size m, using 0(my/nlog m) queries. However, this complexity does not seem to be 
correct (cf. the lower bound of 12 (n) for exact computation of T^ with m = 2 which we prove 
below). 

Kara [32] gave a quantum algorithm for finding an e-approximate modal value which uses 
0((m 3 / 2 logm)/e) queries. Here a modal value is an element which occurs with frequency T^ in 
the input sequence, an e-approximate modal value is an element which occurs with frequency at 
least Too/(l + e), and m is again the size of the set of values. Note that once an approximate modal 
value is determined, F,'x itself can be approximately computed using quantum counting at the cost 
of an additional 0(y/n) queries. A quantum algorithm for computing Fq over sliding windows was 
given in [10], and achieves better time-space tradeoffs than are possible classically. 

In terms of lower bounds, it was shown by Buhrman et al. [18] that computing Fq exactly 
requires 12 (n) quantum queries. This result was later sharpened by Beame and Machmouchi [11] 
to show that even distinguishing between the cases of a function being 2-to-l and almost 2-to-l 
requires 12 (n) quantum queries. 

Very recent independent work of Ambainis et al. [6] has considered a related problem to ap¬ 
proximating Fb: testing the image size of a function. The quantum algorithm of [6] is based in the 
setting of property testing, and has subtly different parameters to the algorithm for To presented 
here. Given oracle access to a function /: [n] —> [m], their algorithm distinguishes between two 
cases: a) the image of / is of size at most k: b) an e fraction of the output values of / need to be 
changed to reduce its image to size at most k. The algorithm uses 0(^/k/elogk) quantum queries. 

1.2 Techniques 

The new quantum algorithms we obtain are based on combining a number of different, previously 
known ingredients. Interestingly, ideas from classical streaming algorithms turn out to be useful 
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for developing efficient quantum query algorithms; on the other hand, previously known efficient 
quantum query algorithms help to develop new quantum streaming algorithms. 

The quantum query algorithm for Fo is rather straightforward and is based around the idea of 
Bar-Yossef et al. [8] from the streaming setting that it suffices to compute the 0(l/e 2 ) smallest 
values of a pairwise independent hash function to estimate Fq. This can be done efficiently using 
a quantum algorithm of Durr et al. [22]. The algorithm for F/,,, k > 2, is more involved, and 
starts from the observation [7] that a good approximation of F\ can be found by counting fc-wise 
collisions in a large enough random subset S of the inputs. On the other hand, if there are not 
too many k -wise collisions in S, the number of k -wise collisions can be computed efficiently using a 
quantum algorithm for ^-distinctness, the problem of finding k equal elements within S [12]. The 
algorithm therefore runs the fc-distinctness subroutine on random subsets S which are exponentially 
increasing in size, until it finds a fc-wise collision. It then switches to estimating the number of 
k -wise collisions using the ^-distinctness algorithm. 

In the quantum streaming model, to approximately compute To we modify a different algorithm 
of Bar-Yossef et al. [8]. The idea is to use quantum amplitude estimation [14] to approximate the 
probability that a random hash function h: [m] —> [F], where R = ©(To), maps any of the elements 
in the stream to 1. This enables a quadratic improvement, in terms of the scaling with e, over the 
classical algorithm in [8]. The main technical difficulty is to ensure that checking whether any of 
the elements in the stream are mapped to 1 can be implemented reversibly and space-efficiently. 
The efficient quantum algorithm for F 2 applies a quantum subroutine for efficient estimation of the 
expected value of random variables with bounded variance [37] to an estimator defined by Alon, 
Matias and Szegedy [3]. Finally, the algorithm for Fx, implements the quantum algorithm of Diirr 
and Hpyer for finding the maximum [23] in a streaming setting. 

The lower bounds in both the query and streaming models are based around the use of reduc¬ 
tions. In the case of the query model, we reduce from well-studied problems in query complexity 
such as the threshold and element distinctness functions. In the case of the streaming model, we 
reduce from the Gap-Hamming, Disjointness and Equality problems in communication complexity. 


2 Quantum query complexity 

In this section, we describe quantum query algorithms for approximately computing F&, followed by 
lower bounds. We use the standard model of quantum query complexity [17, 27]. The algorithm is 
given access to the input via a unitary operator O which maps 0\i)\x) 1 —> \i)\x + a*), where i e [n], 
x E Z m i for some m' > rn. The goal is to approximately compute T \ with the minimal number of 
queries to O. 

2.1 Fq 

Our quantum algorithm for computing To is based on a classical algorithm of Bar-Yossef et al. [8]. 
The starting point is the following idea of Flajolet and Martin [24] and Alon, Matias and Szegedy [3]: 
Given a uniformly random function h: [m] — > [0,1], the value rninj h(a,i) should provide a good ap¬ 
proximation of 1/To. Indeed, the expected minimum of To random variables uniformly distributed 
in [0,1] is precisely l/(Fo + 1). To achieve an estimate of Fo accurate up to relative error e, it turns 
out to be sufficient to know the 0(l/e 2 ) smallest distinct values of /i(oj), for a pairwise independent 
hash function h [8]. We can calculate these efficiently using a quantum algorithm of Diirr et al. [22] 
for finding the d smallest values of a function /, with the additional constraint that the values have 
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to be of different types. 

Theorem 1 (Durr et al. [22]). Given oracle access to two functions /, g : [n] —> Z and an integer d, 
there is a quantum algorithm which uses O(Vdn) queries to f and g and outputs a set of d! indices 
I, where d' = min{d, \{g(j) : j G [n]}||, such that: 

• 9(i) / 9(j) for all i,j G I; 

• For all i £ I and j G [n]\I, if f(j) < f(i) then f(i') < f(j) for some i! G I with g{i') = g(j). 
The algorithm fails with probability at most 5, for arbitrary 5 = 12(1). 

The quantum algorithm for approximately computing Fq is formally described as Algorithm 1. 

Set d = [96/e 2 ], M = m 3 . 

1. Let h: [m] — > [M] be picked at random from a pairwise independent family of hash func¬ 
tions. 

2. Use the algorithm of Theorem 1 with f(i) = g(i ) = h{ai) and <5 = 1/15 to compute the d 
smallest distinct values of h^af). Let v be the ci’th smallest value. 

3. Output dM/v. 

Algorithm 1: Computing To 

Theorem 2. Algorithm 1 makes 0(y/n/e) queries and outputs an estimate of Fq accurate up to 
relative error e with probability at least 3/5 — 1/m. 

Proof. It is shown in the proof of Theorem 1 in [8] that, for the value of d chosen by Algorithm 1, 
dM/v approximates To up to a 1 + e multiplicative factor with probability at least 2/3 — 1/m. The 
claim then follows from the bounds of Theorem 1. □ 

2.2 Fk for k > 1 

We begin by describing the technical tools required for the efficient quantum query algorithm for 
approximating T/, starting with the underlying quantum subroutine for the so-called L-distinctness 
problem. 

Theorem 3 (Belovs [12]). Fix integer k > 2 and real <5 such that 0 < <5 < 1. There is a quantum 
algorithm which, given query access to a sequence S = si,... ,s n , determines whether there exists 
a set I of k distinct indices such that Si = Sj for all i,j G I. The output of the algorithm is either 
such a set I or “no”. The algorithm uses 0{v}~ 2k log(l/<5)) = o(n 3 / 4 log( 1/5)) queries to 

S. It outputs an incorrect answer with probability at most 5. 

This algorithm is normally presented with failure probability 1/3, but this can be reduced to 5 
by repetition, noting that we can check a claimed equal fc-tuple using k additional queries. 

We will also need a technical lemma, which shows that i 7 / can be expressed in terms of the 
number of £;-wise collisions occurring in a random subset of the input integers. This lemma was 
essentially previously shown in [7], generalising the proof of [26] for the case k = 2. However, as 
the terminology and parameter choice of these previous works is somewhat different to our usage 
here, we state and prove it afresh. Let (^) denote the set of fe-subsets of [I]. 
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Lemma 4. Fix £ such that 1 < i < n. Let si,.. 
define 

Ck(s:=\{Te : 

Then 

[Ck(s 1 ) • • • 

and 

2k—1 

Var(C fc ) < ^ 

q=k 


., S£ £ [to] be picked uniformly at random and 
a Si = a Sj for all i,j £ T}\. 


> «<)] = 
l F l /k 



Proof. See Appendix A. 


□ 


1. Set i = n. 

2. For i = 0,..., |"log 2 n]: 

(a) Pick si,... ,s 2 i £ [n] uniformly at random and let S be the sequence a si ,..., a Siii . 

(b) Apply a ^-distinctness algorithm to S with failure probability l/(81og 2 n). 

(c) If it returns a set of k equal elements, set £ = 2* and terminate the loop. 

3. Set M = \K/e 2 ~\ for some universal constant I\ to be determined. For r = 1,..., M: 

(a) Pick si,..., Si £ [n] uniformly at random and let S be the sequence a si ,... ,a se . 

(b) Let T and T' be empty sequences. 

(c) Repeat the following subroutine forever: 

i. Apply a ^-distinctness algorithm to S\T' with failure probability e 2 /(8 Ki). 

ii. If it returns “no”, terminate. 

iii. If it returns a fe-tuple of indices I = (ii,... ,if.) such that the corresponding 
elements of S are all equal, update T to T U / and update T' to T' U {?'&}. 

(d) Let the sequence B = b \,..., be be defined such that bj = St 3 for j = 1,..., |T|, and 
for each j > |T|, bj is an arbitrary integer distinct from all integers bj/ , j 1 < j. 

(e) Set C (r ) := \{U £ ( [ J) : h = bj for all i,j £ U}\. 

4. Output ^E r =i^ (r) - 

Algorithm 2: Computing 

We are now ready to describe the algorithm for computing F^, as Algorithm 2. Informally, the 
algorithm first uses the /c-distinctness subroutine to determine a size £ such that a random subset of 
size £ contains some, but not too many, £:-wise collisions (steps 1-2 below). This is already enough 
to compute F^ up to constant multiplicative accuracy. The algorithm then switches to estimating 
the expected number of k -wise collisions in a random subsequence S of length £ (steps 3-4), and 
uses this to approximate F\ more precisely. The ^-distinctness subroutine is used here too; by 
repeatedly running this subroutine (step 3c), we can find all subsets of size k or greater such that 
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all elements in the subset are equal. The total number of fc-wise collisions will be invariant for any 
integer sequence consistent with the contents of such subsets. So once we know this information, we 
can compute the total number of k- wise collisions in S without any further queries, by constructing 
an arbitrary sequence B consistent with this (steps 3d-e). 

Theorem 5. Algorithm 2 outputs an approximation of F & which is accurate up to relative error 
1 + e with probability at least 3/4, using an expected number of queries which is 

/e 2 )\og(n/e)). 


Proof. First note that, by a union bound, we can assume that all the uses of the ^-distinctness 
algorithms succeed, except with total error probability 1/4. We now show that it is likely that £ is 
chosen such that An/ f! 2 k < £ < Bn/F^ k , for some A and B relatively close to 1. By Markov’s 
inequality and Lemma 4, 

Pr [C k (s 1 ,...,s e )>l}<E Sl _ Se [C k (s u ...,s £ )}= ( ^< ^ (f) . 
si,...,s£ n K n K \ k J 

l/k 

Therefore, the probability that £ is set to be lower than An/F k after the first loop is at most 


F k 


-V 

knJ 


log 2 {An/Fl /k ) 

E 

i =0 
? l/k 


2 ik < 2F k 


e \ k I An 
kn) \F^ k 


= 2 


(Ae' k 

V k 


On the other hand, let £ = Dn/F k , for some D such that B > D > B/2 > 1 and £ > 2. Then 
from Lemma 4, 


Var (C k ) < J2 

q=k 


2k— 1 / BT ,l/k\ 1 2k—1 

^k \ 


n 


Y D q < k D 2k ~ l . 

q=k 


( 1 ) 


So, via Chebyshev’s inequality (aka the second moment method), the probability that the algorithm 
fails to terminate at the point where £ = Dn / f! ' k < Bn/F^ k is at most 


D 2k ~ x n 2k 


j^K4( 51 ,...,«) = o1<^<* 


(FK 2 


^k jj2k-l n 2k k 2kJr 1 2 k 2k+ ^ 

< k - — -= ——— < 


£ 2k F 2 


D 


B 


Fixing, for example, A = (k/e) 20 1 ^ k , B = 20 k 2k+1 , we have that An/F^ k < £ < Bn/F^ k except 
with probability at most 1/5. 

Assuming that £ is indeed bounded in this way, we now show that it suffices to repeat the 
second subroutine 0(l/e 2 ) times to estimate F k up to relative error 1 + e. By Lemma 4 we have 
Var(Cfc) < kB 2k ~ 1 . Assuming that the ^-distinctness algorithm always succeeds, for all r, C* r ) is 
equal to the number of k- wise collisions in a uniformly random subsequence S of size £ of the input 
integers, so is distributed identically to C k . Let C = jj J2r~i . Then Var(C) < kB 2k ~ l /M. 
By Chebyshev’s inequality, 

fc2j^Ak—2 n 2k j(,2fc+l j^Ak—2^2k ]f2k+l j^ik—2 

~ Me 2 ( e ) 2 F 2 ~ Me 2 £ 2k F 2 ~ A 2k Me 2 ' 

\kJ k 


Pr 


-q _ (fc) Fk 


n "• 


> e 


an 


nr 


This implies that, in order to estimate E[Cfc] up to relative error 1 + e with failure probability at 
most 1/5, say, it suffices to take M = [5 k 2k+l B ik ~ 2 /{A 2k e 2 )~\. 



















We finally compute the expected number of queries used by the algorithm. Assume that l = 
0{n/F^ k ) = 0(n 1-1 / fc ) and for conciseness write a = 1 — 2 fc ~ 2 /(2 fc — 1). The first loop makes 

l°g2^ 

y, 0(2 m loglogn) = 0(£ a log log n) = loglogn) 

i =0 

queries. In the second loop, the expected number of repetitions of the subroutine is upper-bounded 
by the expected value of Ck(s \,..., sg), because the number of elements such that there are at 
least k — 1 other elements with the same value is a lower bound on the number of fc-wise collisions. 
For £ < Bn/F^ k , this expected value is 0(1). Therefore, the expected number of queries used by 
the subroutine is 0((n/F^ k ) a log(£/e 2 )) = log(n/e)). As there are 0(l/e 2 ) uses of the 

subroutine, the overall expected number of queries is 0((n a ( 1-1//fe )/e 2 ) log(n/e)) as claimed. □ 

We remark that it might be possible to improve the dependence on e of this algorithm to 0(l/e) 
by replacing step 3 with the use of a quantum algorithm for approximately computing the mean 
given a bound on the variance [37], as in Section 3.2 below. The reason that this does not seem 
immediate is that we only know an upper bound on the expected runtime of step 3, rather than a 
worst-case bound as required by this quantum algorithm. 

2.3 ^ 

We observe that F^ is closely connected to the much-studied (and confusingly named) ^-distinctness 
problem: determining whether a sequence S of integers contains k equal integers [4, 12]. Approxi¬ 
mating F 0 o up to relative error less than 1/(3 k) allows one to solve ^-distinctness. The case k = 2 
(element distinctness) has a lower bound of n(n 2 / 3 ) [4], implying that the same lower bound holds 
for computing F^ up to relative error 0(1). No stronger lower bound is known for higher k. 

On the other hand, if we could solve /c-distinctness for all k, we could compute F^ exactly using 
binary search. One can show by straightforward techniques (see below) that ^-distinctness requires 
fl(n) queries for k = fl(n). However, to approximate F^ it is not necessary to solve ^-distinctness 
exactly, but merely to solve a gapped version of ^’-distinctness. That is, we are given parameters 
k, e and asked to distinguish between the following two cases: 

1. S contains k equal elements; 

2. S contains no sequence of (1 — e)k equal elements or more. 

If we can approximate F ,^ up to relative error e, we can clearly solve gapped ^-distinctness. In 
addition, if we can solve gapped /c-distinctness for arbitrary k, we can approximate F 0 0 using binary 
search, at a cost of an O(logn) factor in the number of queries used. 

2.4 Lower bounds 

We can obtain a number of easy lower bounds on the query complexity of estimating the frequency 
moments via reductions from previously studied problems. 

Theorem 6. Assume m>n + 1 and e < 1/4. The quantum query complexity of estimating Fq up 
to relative error e, with failure probability at most 1/3, is at least Q(y/n/e). For any k > 1, the 
quantum query complexity of estimating T/. up to relative error e, with failure probability at most 
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1/3, is at least ^(n 1 ^ 2 ^ 1 ^ 2 ^/e), an d a ^ so obeys the bound H(n 1//3 ). For k = oo, the quantum query 
complexity is at least £l(n 2 ^ 3 ). For k = oo, the quantum query complexity is also £1(1/e) for any 
m > 2. 

Proof. We first deal with the To lower bound, by a reduction from the threshold function Th^ on 
n bits, for d < n/2. This function is defined by Thrf(.x) = 1 if \x\ > d, and Thd(x) = 0 otherwise. 
Given an input x £ {0, l} n , define a sequence of n integers a* by a* = i if X{ = 1, and a* = 0 
otherwise. Then Th^(x) = 1 if and only if Fq > d. To determine this, it suffices to approximate To 
up to relative error l/(4d). As the threshold function has a lower bound of £l(y/dn) for d < n/2 [9], 
setting d = [ 1 /e] implies the claimed result. 

For the first bound for k > 1, we reduce quantum counting to estimating T/. Consider the 
problem of determining whether an unknown n-bit string has Hamming weight t < n/2, or has 
Hamming weight l + A, given access to queries to the bits of the string. This requires £l(y/n/ A + 
yJTn/ A) quantum queries [39]. For any bit-string x £ {0, l} n , define a sequence of n integers a* 
such that at = i if Xi = 0, and a% = 0 if x\ = 1. Consider two strings x, y such that |x| = n 1/,fc , and 
|y| = (n(l + Se)) 1 /^'; so t = n 1 / fc , A = n l / k (( 1 + Se) 1 /^ — 1). Then T/ is equal to 2n — nf! k for the 
first corresponding sequence, and 2n + 8 en— (n(l + 8 e)) 1,/fc for the second sequence. One can verify 
that approximating T). up to relative error e allows these two cases to be distinguished. Then the 
lower bound of [39] implies that this problem requires 

quantum queries as claimed. 

For the H(n 1//3 ) bound for k > 1, we use a reduction from the collision problem with small range, 
which has a lower bound of S2(n 1//3 ) quantum queries [35, 5]. Let ,S] be a sequence of n numbers 
where each number occurs once, and let S 2 be a sequence of n numbers where each number occurs 
twice. Then Fk(Si) = n, T/^S/) = n2 k _1 . So estimating T/ up to multiplicative error e < 1/4 
allows these two cases to be distinguished for any k > 1 . 

The H(n 2 / 3 ) bound for k = 00 follows from the lower bound on the quantum query complexity of 
element distinctness with small range [5], which is clearly no easier, while the £1(1/e) bound follows 
from [39] using a similar argument to above, considering the problem of determining whether an 
unknown bit-string has Hamming weight n/2 or Hamming weight (1 + e)n/2. □ 

We finally consider the case of computing T/ with very high accuracy. 

Theorem 7. For any fc / 1, and m > n /2 + 1, the quantum query complexity of computing T/ up 
to 0(l/n) relative error, with probability of failure at most 1/3, is @(n). For k = 00 , this bound 
still holds for any m > 2. 

Proof. First we take k 7 ^ 00 . Beanie and Machmouchi [11] showed that the quantum query com¬ 
plexity of the following problem is 0(n). We are given query access to a sequence of n integers at , 
each picked from [m], where m > n/2 + 1. Either, for each i, there exists precisely one j / j such 
that a* = aj\ or this holds for precisely n — 2 indices i, while for the other two indices i!. there 
is no j 7 ^ i' such that = aj. Our task is to distinguish the two cases. Let Si be a sequence 
of the first form, and let S 2 be a sequence of the second form. For k > 1, Fk(S 1 ) = 2 k ~ l n and 
Fk(S 2 ) = 2 k ~ l n + 2. (For k = 0, we have n/2 vs. n/2 — 1). So computing T). up to 0(1/n) relative 
error for any k / 1 allows us to distinguish Si and S 2 . 

For k = 00 , a lower bound of £1(1/e) was already shown in Theorem 6 . □ 
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3 Quantum streaming complexity 


We now move on to studying the quantum complexity of computing Ff~ in the T-pass streaming 
setting. The model here is defined as follows: 

1. The quantum algorithm stores a quantum state | 'ip) of S qubits, initialised to some starting 
state which does not depend on the input. 

2. Integers in the input stream are received one-by-one until the end of the stream; as each 
integer a arrives, a corresponding operation U a is performed on \if). 

3. Step 2 is repeated T times. 

4. At the end, a measurement is made on \ip) which is supposed to reveal TV 

We remark that, in the case T = 1, this model is very similar to a one-way quantum finite au¬ 
tomaton [38], and also to variants of the streaming model studied by Gavinsky et al. [25] and Le 
Gall [36]. We could have (essentially equivalently) also defined this process by splitting the stored 
qubits into two registers, and performing the following operations for each arriving element a: 

1 . Apply U a to the first register, where U a \x) = | x + a). 

2. Apply some fixed unitary operation V to both registers. 

3. Apply U~ l to the first register. 

We assume that the algorithm knows the number n of elements in the stream in advance. 


In order to obtain an efficient quantum algorithm for estimating To in the multiple-pass streaming 
model, we will modify another efficient classical algorithm of Bar-Yossef et al. [ 8 ]. The basic idea 
is as follows. First, a rough estimate R of To can be obtained using a classical streaming algorithm 
of [3], which returns some R such that R = ©(To) with high probability using only 0(log?n) 
space. Then, if h : [m] —> [i?] is a random function picked from a f-wise independent family of hash 
functions, for some t = 0( log 1 /e), the probability (over the random choice of h ) that h maps any 
of the elements in the stream to 1 provides a good estimate for To. Here, rather than sampling 
random functions h to estimate this quantity, we will use amplitude estimation [14]. 

The main claim that we need to check is that the operation of checking whether h maps any of 
the elements in the stream to 1 can be performed reversibly in a space-efficient fashion, with only a 
few passes over the stream. Note that standard reversible-computation techniques do not seem to 
immediately imply this, because the general technique used to reversibly implement each operation 
in an initially irreversible computation stores “garbage” bits for each step in the computation [40], 
which are later uncomputed. Storing a garbage bit for each element in the stream would use space 
0 (n). 

Lemma 8. Let a ±,..., a n be a stream, and let H, \H\ = M , be a family of functions hj : [m] —» [R] 
such that the map H: (j, x) i —> hj{x) can be implemented reversibly classically in time T and space 

S. Then there is a quantum algorithm which estimates Pr j[3i,hj(ai) = 1] up to additive error e 
using space S + 0(logn + log 1/e), 0(l/e) passes over the input, and time 0{nT) per pass. 
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Proof. Set p = Prj[3i, hj(cii) = 1], and for each j write Nj = |{* : hj(a,i ) = 1}|. We will apply 
quantum amplitude estimation to estimate p. To do so, we need to coherently implement the 
function /(j) = [3i, hj(ai ) = 1]. We will show that this can be implemented with two passes over 
the stream and space S + O(logn). For each element a, the map 

U a : \ j)\y) ^ \j)\y + [hj(a) = 1]) 

can be implemented with two uses of H (one to compute, and one to uncompute), each of which 
uses time T and space S. After the whole stream has been read in, performing this map for each 
element a*, we have effectively implemented the map 

|j)l°) \d)\ N j) 

in total time 0(nT). We now use an ancilla register to store whether the second register is nonzero: 

U)| 0 )k) ^ \j)\ N j)\ z + = 1 ]). 

It remains to uncompute the contents of the second register. We can do this by reading the stream 
in again and performing the map 

this requires only one extra qubit to remember whether we are adding or subtracting. The overall 
result is that we have implemented the map 

\j)\z) H- \j)\z + [3 *,) = 1 ]) 

as required, with two passes over the stream and S+0(log n) space. Quantum amplitude estimation 
requires 0 (l/e) uses of this map and its inverse, and 0( log 1/e) qubits of additional space, to 
estimate Pvj[3i, hj(ai) = 1] up to additive error e [14]. □ 


We now apply Lemma 8 to the framework of Bar-Yossef et al. [ 8 ]. Let 1Z be the set of all 
functions h: [m] —> [i?], and set r = Pi'/j £fc[3i, h{af) = 1]. The following lemma says that, if we can 
approximate r, we can approximate Fq. 

Lemma 9 (Corollary of Bar-Yossef et al. [ 8 ]). Fix e < 1 and assume that R satisfies 2Fo < R < 
50Fq. Assume that r satisfies \r — r\ < e/150 and define 


ln(l — r) 
ln(l -l/R)' 


Then |Fq — Fq| < eF$. 


In addition, if we replace 1Z with a t-wise independent family of hash functions for large enough 
t, the probability (over the random choice of hash function h) that there exists an i such that 
h(ai) = 1 is not substantially affected. 

Lemma 10 (Corollary of Bar-Yossef et al. [ 8 ]). Let R be a t-wise independent family of hash 
functions hj : \m] —> [i?], where t = [~ln(300/e)/ln5]. Set p = Pr j[3i,hj(ai) = 1]. Then \p — r\ < 
e/300. 
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Set t = |"lii(300/e)/ln5~|. 

1. Use the algorithm of [3] to obtain an estimate R such that 2Fq < R < 50-Fo using one pass 
over the stream and space O(logm), with probability at least 3/5. 

2. Let R be a family of f-wise independent hash functions hj : [to] —> [i?]. 

3. Using the algorithm of Lemma 8 , estimate p = Pr j[3i,hj(ai) = 1] up to additive error 
e/300. Call the estimate p. 

4. Output ln(l — p)/ ln(l — 1/i?). 

Algorithm 3: Streaming estimation of Fq, based on [ 8 ] 

We now have all the ingredients we need for the Fq estimation algorithm, which is formally 
described as Algorithm 3. Note that the only quantum ingredient of this algorithm is the use of 
amplitude estimation in step 3. 

Theorem 11. Algorithm 3 computes Fq up to relative error e, with failure probability at most 1/3, 
using space 0 (logmlog(l/e) + logn) and 0( 1 /e) passes over the input. 

Proof. The claim follows from Lemmas 8 , 9, and 10. In somewhat more detail: by Lemma 10, after 
step 3 of the algorithm, assuming that step 1 has succeeded, \p — p\ < e/300 and \p — r\ < e/300, so 
\p—r\ < e/150. By Lemma 9, the output of the algorithm differs from Fq by relative error e. Lemma 
8 states that approximating p to the required level of accuracy can be done using 0 (l/e) passes 
over the input. Step 1 uses space O (log to), and step 3 uses space S + 0(logn + log 1/e), where S 
is the space required to specify a member of the family R of hash functions. R can be chosen such 
that S = 0{t\ogm) = 0(logmlog(l/e)), so the overall space usage is 0(logmlog(l/e) + logn) 
qubits. □ 

3.2 F '2 and iq., k > 2 

To compute F 2 in the streaming model, we will apply the following result to ideas from the F 2 
approximation algorithm of Alon, Matias and Szegedy [3]: 

Theorem 12 (Quantum approximation with a bound on the relative variance [37]). Let v(A) be 
the distribution on the outputs of a quantum algorithm A such that E[u(*4) 2 ]/E[u(.4)] 2 < B, for 
some B > 1, and A uses S qubits of space. Then there is a quantum algorithm which approxi¬ 
mates E[u(^4)] up to additive error eE[u(^4)], with probability at least 2/3, and uses A and A 
0((B/e) log 3,/2 (B/e) log log(L?/e)) times. The algorithm uses 0(S + log(L>/e)) qubits of space. 

The algorithm of [3] uses a set of M = 0(m 2 ) 4-wise independent hash functions hi : [to] —> 
{± 1 }, and approximately computes the expected value of the function f(i ) = hi(j)nj^ 

over the random choice of hash function hi. This is sufficient to approximate iU: 

Claim 13 (Alon, Matias and Szegedy [3]). If i G [M] is picked uniformly at random, E*[/(*)] = F 2 
and Var(/) < 2Ff. 

Here we would like to apply the algorithm of Theorem 12 to accelerate this procedure. To do so, 
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we need to compute / reversibly and space-efficiently. For each hash function h, we can compute 


Eh(ai) = £ h U)"j 

i=1 j =1 

using one pass over the stream. Further, we can compute f(i ) reversibly for any i using two passes 
and space 0(logm + log?r) = O(logn). We first perform the map 

n 

|i)|0)|y) \i)\^hi{ aj ))\y + f{i)), 

3 =1 

using one pass over the stream. We then use a second pass over the stream to subtract hi(cij) for 
each j, so the state of the second register is effectively unchanged and we have performed the map 
\i)\y) i->- \i)\y + /(*))• To carry out the inverse operation, we do the same thing in reverse. 

We can therefore apply Theorem 12 to /, and obtain the following result: 

Theorem 14. Algorithm 4 computes Fi up to relative error e, with failure probability at most 1/3, 
using space 0 (logn + log(l/e)) and 

0{{ l/e)log 3/2 (l/e) loglog(l/e)) = 0(l/e) 


passes over the input. 


1. Let % be a family of 0(m 2 ) 4-wise independent hash functions hj : [m] —> {±1}. 

2. Apply the algorithm of Theorem 12 with accuracy bound e to the following subroutine: 

(a) Pick /iGU uniformly at random. 

(b) Output (YA=iH a i)) 2 - 

Algorithm 4: Streaming estimation of F 2 , based on [3] 

In the case of other moments F k , for fixed k > 2, we can do something similar (but less 
efficient), using a different estimator described by Alon, Matias and Szegedy [3]. For i e [n], let 
N(i) = | {j : j > i,ai = aj}|, and let IW(z) = n(N(i) k — (N(i) — l) fc ). Then the following lemma 
holds: 

Lemma 15 (Alon, Matias and Szegedy [3]). If i E [n] is picked uniformly at random, then 

Ei[iV fc (t)] = F k , Var(A^fc) < km^^Fl 

It is clear that N k (i) can be computed reversibly using two passes over the stream (one to com¬ 
pute N(i) and one to uncompute it), using space O(logn). Using Theorem 12, we can approximate 
F k up to additive error eF k using 

0 ((m 1 - 1 /,fc /e) log 3 / 2 (m 1 - 1 / fc /e) log log (rnf-^/e)) = d(m l ~ l / k /e) 

passes and space 0(logn + log(m 1 ^ 1 ,/fc /e)). This is sometimes superior to the best classical algo¬ 
rithms [15], but only for very small e < 
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3.3 Foo 

The quantum streaming algorithm for computing is straightforward, based on a streaming 
implementation of the maximum-finding algorithm of Durr and Hpyer [23]. Using one pass over 
the stream, we can implement the map 


\j)\ x ) ^ \j)\ x ± n j) 

for any j simply by adding (or subtracting) 1 to x each time we see an element with value j. We can 
use this as an oracle within the quantum algorithm of Durr and Hpyer, which outputs the maximum 
of N integers, using quantum space 0(log 2 N) and 0(y/N) queries [23]. This immediately gives 
the following result: 

Theorem 16. There is a quantum algorithm which computes exactly, with failure probability 
at most 1/3, using space 0(log 2 m) and 0(y/n) passes over the input. 

3.4 Lower bounds 

Just as in the classical world, lower bounds on quantum communication complexity (see e.g. [16] 
for an introduction) can be used to lower-bound the quantum complexity of computing functions 
in the streaming model. Alice and Bob divide the input aq,..., a n , b\,..., b n into two; Alice gets 
the first half a\, ..., a n , Bob the second half b\,... ,b n . If there is a streaming algorithm which 
computes T]fc using T passes over the input and stores S qubits, by simulating this algorithm Alice 
and Bob obtain a two-way quantum communication protocol which communicates 0(TS ) qubits in 
total, has no prior shared randomness or entanglement, and computes Ff.. If there is a single-pass 
streaming algorithm, this gives a one-way quantum communication protocol. 

We first observe that a bound of Alon, Matias and Szegedy [3] extends to give a general D(logn) 
space lower bound in the quantum setting, and an 12(i/n) bound for k = oo. Throughout this section 
we assume that m > 2 n. 

Theorem 17. Assume there exists a protocol in the multi-pass quantum streaming model which 
stores S qubits and uses T passes to compute Ft for a stream of n elements up to relative error 
1/8, with failure probability 1 /3. Then: 

• if k 1, TS = D(logn); 

• if k = oo, TS = £l(y/n). 

Proof. In the proof we use o to denote the concatenation operation on integer sequences. 

• (/c F 1) : Alice and Bob will embed the equality function on @(n) bits in their inputs. Choose a 
family of 2^( n ) subsets of [n] of size n/4 such that each pair of subsets has at most n/8 elements 
in common. Then, if Alice receives input x, Bob receives input y, they encode these as subsets 
S x , S y . If their strings are equal, Fk(S x o S y ) = n2 k ~ 2 \ otherwise, Fq(S x o S y ) > 3n/8 and 
Fk{S x o S y ) < n/4 + n2 fc ~ 3 . For any k / 1, there is at least a constant factor gap between the 
values of F\ in these two different cases. In particular, approximating Ff. up to relative error 
1/8 allows equality of x and y to be tested. This has an D(logn) quantum communication 
complexity lower bound [34], 
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• (k = oo): Alon, Matias and Szegedy [3] give a reduction from Disjointness, which we re¬ 
peat here. Given sets S a , Sb, Alice and Bob simply apply the streaming algorithm to the 
concatenation S a o Sb- If there are any elements in common, F 00 (S a o Sb) > 2; otherwise, 
Foo(S a o Sb) = 1. So computing F ,^ up to relative error e, for any e < 1/3, allows Alice 
and Bob to determine whether their sets are disjoint. This has a quantum communication 
complexity lower bound of £l(y/n) [41]. 


m 


There is also a straightforward bound on the complexity of exact computation. 

Theorem 18. Assume there exists a protocol in the multi-pass quantum streaming model which 
stores S qubits and uses T passes to compute F / exactly for a stream of n elements, with failure 
probability 1/3. Then, if k ^ {0,1, oo}, TS = D(n). 

Proof. We reduce from the problem of computing the Hamming distance between two bit-strings 
x, y E {0, l} n , which has a quantum communication complexity lower bound of Tt(n) [28]. Given x, 
Alice produces an ?z-element sequence by setting the i’th element to be i + nxi, and Bob produces a 
similar sequence whose i’th element is i + ny*. Then for any k ^ {0,1, oo}, T), of the concatenated 
sequence is precisely n2 k — (2 k — 1 )d(x, y), so determining T} exactly enables the Hamming distance 
between x and y to be computed. □ 


We now prove a general quantum lower bound on approximating T/ in the streaming model, 
based on a sequence of reductions, all following from previously known results. The key point 
is that good approximations to Fj~ are known to give efficient protocols, in the setting of two- 
way communication complexity, for a problem known as Gap-Hamming-Distance [29, 42, 19]. Let 
GHD ni t be the partial function defined on a subset of {0, l} n x {0, l} n as follows: 


GHD„ it (:r,y) 


0 if d(x, y) <t — \Jn 
1 if d(x, y) >t + y/n 


Then we have the following sequence of claims: 


Claim 19 (from Indyk and Woodruff [29], Woodruff [42]). Fix k ^ {l,oo}. Assume there is a 
protocol in the multi-pass quantum (resp. classical) streaming model which stores S qubits (resp. 
bits) and uses T passes to approximate F / up to relative error e, with failure probability p, for a 
stream ofn elements picked from a universe of size m. Then, if e > \/y/m, there is £ = 0(l/e 2 ) such 
that there is a quantum (resp. classical) protocol in the 2-way communication model for GHD^jii^, 
which has failure probability p and uses 0(TS) qubits of communication. 

Claim 20 (Chakrabarti and Regev [19]). Fix a E (0,1/2], Then, if there is a quantum (resp. 
classical) communication protocol for GHD nn / 2 using c qubits (resp. bits) of communication with 
failure probability p, there is a quantum (resp. classical) communication protocol for GHD n an using 
O(c) qubits (resp. bits) of communication with failure probability p. 

Claim 21 (Razborov [41], see [33] for version here). Fix a Q-qubit quantum communication protocol 
on n-bit inputs x, y, with acceptance probabilities P(x, y). Write P(i) = IE| a; | = |j / | =n / 4 i | a ; Ay | = j[P(x, y)\. 
Then, for every d < n/4, there exists a degree-d polynomial q such that \P(i) — q(i)\ < 2~ d / 4 + 2 Q 
for all i E {0,..., n/4}. 
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Claim 22 (Nayak and Wu [39]). Let q : {0, ...,n} —> [—1/3,4/3] be a degree-d polynomial such 
that q(a) < 1/3, q(b) > 2/3 for some a,b £ {0, ..., n}. Let c € {a, b} be such that \n/2 — c| is 
maximised, and let A = \a — b\. Then d = Q(y/n/A + yjc{n — c)/A). 

Theorem 23. Assume there exists a protocol in the multi-pass quantum streaming model which 
stores S qubits and uses T passes to compute up to relative error e > 1/y/rn for a stream 
of n elements picked from a universe of size m, with failure probability 1/4, for i; / 1, Then 
TS = Q( l/e). 

Proof. The theorem follows from Claims 19 to 22. Assume there exists a protocol which stores S 
qubits and uses T passes to approximate up to relative error e, with success probability 3/4. 
Then by Claim 19 there is a protocol for GHD^^ 2 : where £ = ©(l/e 2 ), with the same success 
probability, using 0(TS ) qubits of communication. By Claim 20, there is similarly a protocol for 
GHD^/ 8 using Q = 0(TS) qubits of communication. Now consider the special case of this problem 
where the inputs x, y are restricted to Hamming weight £/&. Then d(x,y) = £/2 — 2\x Ay\, so in the 
notation of Claim 21, P(i) < 1/4 for i > £/8 + \fi/ 2, and P(i) > 3/4 for i < 1/8 — \ft/2. Taking 
d = O(Q), there is a degree-d polynomial q such that q(i) <1/3 for i > 1/8 + Vi/2, q(i ) > 2/3 for 
i < £/8 — \fl/2. By Claim 22, we must have d = Thus TS = = ST(l/e), completing 

the proof. □ 


4 Outlook 

We have initiated the study of the quantum complexity of approximately computing the frequency 
moments. However, there are still many open questions to be resolved. In particular: 

• What is the quantum query complexity of approximately computing F <*,? As discussed in 
Section 2.3, this seems to be closely connected to a “gapped” version of the well-studied k- 
distinctness problem, whose precise complexity is still unknown. For each k > 2, improved 
bounds on /^-distinctness would also improve our algorithm for computing F^. 

• What is the quantum streaming complexity of approximating Ff. for k > 2? Just as the 
efficient quantum algorithm for F 2 is based on the streaming algorithm of Alon, Matias and 
Szegedy [3], it would be interesting to determine whether more recent streaming algorithms 
for l 7 /. [29, 13, 15] could be used to obtain efficient quantum algorithms. 

It would also be interesting to find a practically relevant problem demonstrating a separation 
between quantum and classical streaming complexity in the one-way model. This could involve 
proving a separation between one-way quantum and classical communication complexity for a total 
function, which is a major open problem. 
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A Proofs of combinatorial bounds 


Lemma 4 (restated). Fix t such that 1 < i < n. Let s\,...,S£ E [n] be picked uniformly at 
random and define 

Ck(si, ...,se):= \{T E : a Si = a Sj for all i,j E T}\. 


Then 


and 


E Sl _ Se [C k (s 1 ,...,s e )]= ( ^ 


n * 


Var (C k ) < Y 


2k—1 / ,„l/fc\ 1 

1 ir. 


q=k 


n 


Proof. First observe that, for any set T E (^), 

1 n 

Pr [a Si = a Sj for alH, jet] =-* Y 


Sl,-.,Se 

For the expectation, we compute 


pi,...,p k =i 


, _ _ } _Fk 

\ a Pi — ■■■ — a p k J — nfc • 


E sl) ... lS jC' fc (si,... ,sd] = E sli ... )S J|{T E : a Si = a Sj for all i, j E T}\\ 

E Pr \a Si = a s . for all i,j E T] 

Sl,...,S£ 


Tel 


(i)F k 


n "■ 


2 n 


We now bound the variance. We have 
[C k {s u ..., s e ) 2 ] 

v 

= E sl) ... jS ^ Y [ a «» = a sj for a11 Lj e T \ 

_\ Te (*) 

E Pr [a Si = a s , for all i, j E T, and a s = a s for all p,q eU] 

Sl,...,S£_ J 

T,ce(W) 

E Pr [o s . = a s , for all i,j E T, and a s = a s for all p,q eU] 

Sl,...,S| J 

T,ce( [ ( 1 ),rnc/^0 

+ E 


Pr [a Si = a Si for all i, j E T, and a s = a s for all p, q E U] 

Sl,— ,S£ J 


T ,ue( l i l ),Tnu=<t> 


Y Pr [a s . = a s . for all i,j ETUl/1 


T,ce( [ ( 1 ),Tn[/^0 

+ E 

T,c/e( [ f ) ),Tnf/=0 


Pr [a Si = a s . for all i, j E T] Pr [a s , = a s . for all ij E U] 

Sl,...,S£ J Sl,...,S£ J 


(2) 
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2k—1 

E \^ Ue 

q=k 


k j--\ T UU\=q}\^ + \{T 1 Ue 


M 


: \T U U\ = 2k}\ ( —£ ] , 


n n 


where the final equality is (2). We have the rough bound that 

\{T, U € : \T U U\ = g}| < t 2k ~ q f {q ~ k) = i q , 

because we can specify T and U by picking the |Tn U\ = 2k — q elements in their intersection, then 
the q — k elements in each set (T U U)\T, (T U U)\U. We also have 


1/9 


1/k 


F » 1/, = E“! s E”‘ =F < 


— T7 l / k 


for any q > k, by monotonicity of t v norms. Combining these two bounds, 

«■. 


Therefore 


Var(Cfc) = E ai ,..., s jC' fc (si, ..., s e ) 2 ] - 0E S1 ,..., S *[Cfc(si, • • •, s^)]) 2 



as claimed. J3 ; 
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